1. Data protection
All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256. Backups are encrypted and stored in geographically redundant locations.
2. Infrastructure
Our services run on hardened, isolated cloud infrastructure with private networking, automated patching, and least-privilege configuration across all environments.
3. Access control
Access to production systems is restricted to authorized personnel, protected by multi-factor authentication, and granted on a strict need-to-know basis with regular reviews.
4. Monitoring and logging
We continuously monitor our systems for anomalous activity, retain audit logs of privileged actions, and alert on suspicious events around the clock.
5. Compliance
Our security program is built to align with industry standards and applicable data protection regulations. We review our controls regularly and engage independent assessments.
6. Incident response
We maintain a documented incident response plan with defined roles, escalation paths, and notification procedures so we can act quickly to contain and remediate issues.
7. Responsible disclosure
We welcome reports from security researchers. If you believe you have found a vulnerability, please contact us so we can investigate and resolve it promptly.